Author Topic: Hacking the Rigol DHO800/900 Scope  (Read 2162087 times)

ch274, sanchos133 and 41 Guests are viewing this topic.

Online 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1841
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4250 on: November 24, 2025, 09:49:50 pm »
Right now Im not sure about memory depth limitations in MHO900 with LA.
Looks like the LA on the MHO900 samples with 1GSa/s and the sample memory is 125MPts
Trying is the first step towards failure - Homer J. Simpson
 
The following users thanked this post: egonotto, norbert.kiszka

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4251 on: November 25, 2025, 01:34:11 am »
Right now Im not sure about memory depth limitations in MHO900 with LA.
Looks like the LA on the MHO900 samples with 1GSa/s and the sample memory is 125MPts

DHO800/900 FPGA allows no more than 31.25 Mpts. But still there is 25% faster LA sample rate :)

Offline mrisco

  • Regular Contributor
  • *
  • Posts: 223
  • Country: pe
    • Github Profile
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4252 on: November 27, 2025, 02:21:11 pm »

Offline mrisco

  • Regular Contributor
  • *
  • Posts: 223
  • Country: pe
    • Github Profile
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4253 on: November 28, 2025, 02:55:06 am »
Reddit moderators are becoming increasingly unreasonable. They're now banning me from one site just because they don't like something I posted on another.

2706397-0

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4254 on: November 28, 2025, 04:48:28 am »
Reddit moderators are becoming increasingly unreasonable. They're now banning me from one site just because they don't like something I posted on another.

Let me answer this from my perspective.

No matter if somebody likes this or not, but we both are doing some software. Some of it may be for Rigol devices and some of this some, may be not free of charge, which is the case here, but it doesn't matter.

Rigol makes quite good hardware for the price, but the firmware is a crap.

Lately Rigol started selling MHO900 series (I think MHO98 is included in it) and they added small and simple change to "protect" it from unlocking options like a higher bandwidth, memory depth and other things. I breached it in one day, without having any scope from this series and users of MHO934 can use 1 GHz bandwidth without paying 480$. They have two AFG which they already payed for, but Rigol locked it and required to pay "just" 800$ to flip a one bit and make possible to use it.

I breached it, not because Im good or something. But rather because their coders are bad (or cheap if You prefer).

Yesterday I received email from one of my MHO900 mod users. Along the things he said: "few owners of MHO98 being the influencers" (shortened quote).

When they did DHO800/900 firmware, it was a copy od DHO4000 firmware with some changes. Why they disabled a lot of triggers, decoders, UPA and other things? Because they want from You to buy DHO4000 or other very expensive model, just to have one stupid thing in the firmware. Some users maybe will prefer to have small portable scope with those things, even with paying the price for DHO4000, but Rigol doesn't give a f*ck.

Some weeks ago, on this exact forum there was some people accusing me of doing "illegal" things against Rigol company and it was like hurting their feelings, because some "innocent" company from China with small revenue of 23.2 M was going to get broke.

Jokes aside, fighting with it works just like a Streisand effect, which means it's completely opposite result - it's very bad for the company reputation. Funny thing, all accusations from all of them just stopped in the same day - it can mean only one thing: Rigol payed for this.

On this forum there is a lot of people and only one moderator. There was a war and a lot of insults from those people, but this one mod banned me (muted if You like) for one week and nobody else. Coincidence?

Not longer than 10 h ago I got permanent ban on this subreddit too. Coincidence?

Still I have no reply from the mod and I guess both of us will never receive any reply from them. Rigol payed good enough money. I guess 100$ was enough.

2706417-0

As You can see, I added my posts before this rule was added. They added this rule and my post was deleted. Why they banned me month later? Money from Rigol of course. Some people will do such things for money like 100$, because it's not more than 5 minutes and they feel safe. You will never know neither real name of the mod or even nickname.

Most of the subreddits has a random people as a mod. You can be banned anytime, not because You breaked any rule, but because one person had some interest in it, even purely emotional. Which happened to me once on other not technical subreddit. On the side note, Reddit become much worse for different reasons lately (I heard something about new CEO).

PS. Few months ago Rigol did one change in the SD card for DHO800/900. For 99% it was done to prevent from installing OS modifications. My mod (scripts) was not only installing modified app but also doing changes in OS mostly to increase performance and to add features like a easy access to Android desktop. People reported this problem and it was extremely easy to fix it remotely. Now I automated it in the scripts, so it will not fail, no matter if this is old one or a newer one.
« Last Edit: November 28, 2025, 05:13:42 am by norbert.kiszka »
 
The following users thanked this post: baciocco

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4255 on: November 28, 2025, 04:58:30 am »
Aside the attacks from the Rigol, I have plans to add more bandwidth filters in my mod (binary AFE flags from other models with same exact AFE chip) and to correct existing ones (displayed bandwidth value in the UI).

About the last thing, filter 70 MHz is sending the same AFE flags as in the DHO804, but in the reality it does first order filter (RC filter) with -3 dB at around 100-110 MHz. This 30% difference can be at least annoying.

Those filters are 200 MHz, 250 MHz, 300 MHz, 350 MHz, 400 MHz (maybe...), and 500 MHz. If I will got some luck, I will manually find flags to enable some more - once I did one filter in that way.

As (almost) always, it will be a free update.
« Last Edit: November 28, 2025, 05:00:30 am by norbert.kiszka »
 
The following users thanked this post: thm_w, TUMEMBER, baciocco

Offline mrisco

  • Regular Contributor
  • *
  • Posts: 223
  • Country: pe
    • Github Profile
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4256 on: November 28, 2025, 05:23:03 am »
...Rigol payed good enough money. I guess 100$ was enough...

It's unbelievable and very sad. At the very least, they should purchase our modifications to copy the fixes and improvements. I think that we contribute to their hardware sales.

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4257 on: November 28, 2025, 05:27:58 am »
At the very least, they should purchase our modifications to copy the fixes and new implementations.

I doubt that.

Never heard about famous painter from Vienna and his friends fighting to the very end?

Sad thing, from time to time I was helping people on this subreddit. I guess it will never happen again.

Offline westendgate

  • Newbie
  • Posts: 4
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4258 on: November 28, 2025, 09:07:45 am »

PS. Few months ago Rigol did one change in the SD card for DHO800/900. For 99% it was done to prevent from installing OS modifications. My mod (scripts) was not only installing modified app but also doing changes in OS mostly to increase performance and to add features like a easy access to Android desktop. People reported this problem and it was extremely easy to fix it remotely. Now I automated it in the scripts, so it will not fail, no matter if this is old one or a newer one.
[/quote]

That at least explains the strange behavior of my device. It was probably manufactured in June 2025. The revert.gel doesn't work for me.

I'm now using the Scope with the original software. This works flawlessly.

PS: Mrisco's mod also doesn't work for me. The Scope hangs very early in the boot process. ADB isn't possible yet because there's no network connection. Communication with the creator was unsuccessful.
 

Offline Impedancer

  • Newbie
  • Posts: 1
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4259 on: November 28, 2025, 09:30:55 am »
How to use the scope as an android tablet :)
With sound!
...

11) OPTIONAL. If you plan to boot into yourSimpleLauncher and be able to launch the scope app any time later:
- install MyAndroidTools,
- disable "GuardServiceReceiver" for the "com.rigol.launcher" application (MyAndroidTools/apps/com.rigol.launcher/see all component info/broadcast receiver/GuardServiceReceiver).
This will prevent FPGA initialization, reduce CPU usage, thus reducing power consumption (from 2.5 A to 1.2 - 1.4 A @12V), chip temperature, and increase device sustainability.

But in this way, you can launch the RIGOL.SCOPE app from the launcher any time later.

Thanks for this great info. The power consumption is in my case approx. 21W before starting the rigol.scope app the first time from my launcher (Nova). With the started rigol app it takes about 38W (measured at the ac socket). But when I switch back to the launcher and kill the rigol app the power stays at about 34W. Even unloading all the modules the rigol app uses and flashing the fpga with zeros brings it back only to 32W. How is it possible to deactivate all scope relevant parts so that the power is again 21W as it was before the first start of the rigol app? Is it possible at all or can only a fresh start (power-off-reboot) bring the hardware back in a pre-rigol-app-start-state?

I am asking because I am planning to regulate the fan with a ntc and it would be nice if it would be quieter at least when the rigol scope is not running. ;-) Thanks for your feedback.
 

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4260 on: November 28, 2025, 01:45:48 pm »
That at least explains the strange behavior of my device. It was probably manufactured in June 2025. The revert.gel doesn't work for me.

I don't know if I asked this before, but did You tried to use Dave SD card image? It's from one of the earliest DHO814 and it works properly on my DHO924S.

Only one problem is with AFG DC offset, which can be fixed by reverting original contents of /rigol/data which contains files with calibration data, including AFG.

I am asking because I am planning to regulate the fan with a ntc and it would be nice if it would be quieter at least when the rigol scope is not running. ;-) Thanks for your feedback.

My DHO924S was working without the fan all day long. However it was with different OS.

Nova

My mod (both .GEL and external script) installs Nova, Android soft buttons (auto hide after few seconds) and scope app is started only once after boot.

Offline dzebrys

  • Contributor
  • Posts: 17
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4261 on: November 28, 2025, 02:52:36 pm »
PS. Few months ago Rigol did one change in the SD card for DHO800/900. For 99% it was done to prevent from installing OS modifications. My mod (scripts) was not only installing modified app but also doing changes in OS mostly to increase performance and to add features like a easy access to Android desktop. People reported this problem and it was extremely easy to fix it remotely. Now I automated it in the scripts, so it will not fail, no matter if this is old one or a newer one.

maybe that will explain why in my scope with mod v0.4.2 i lost easy access to Android desktop.
gesture swipe on right screen side is not working, when enable permanent nav bar on bottom
through Settings->Accessability then no reaction on triangle button -> scope app is in god mode.
the NovaLauncher is correctly installed.

but as i remember that was not a case for few first versions installed.
can u share some details? otherwise i'm in need to revert to factory image.

br/Piotr
 

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4262 on: November 28, 2025, 03:08:39 pm »
gesture swipe on right screen side is not working

It was always swipe from the top corner to bottom.

It's purely Android code.

BTW. In my mod there is a third party replacement for this, which You can enable manually. It's has a lot of settings and it seems to have less bugs with basic things. Screenshot in the attachment.

If for some reason You still can't get into Nova launcher (Android desktop), connect USB keyboard, ALT+TAB and swipe out the scope app.

Offline mrisco

  • Regular Contributor
  • *
  • Posts: 223
  • Country: pe
    • Github Profile
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4263 on: November 28, 2025, 03:42:55 pm »
ADB isn't possible yet because there's no network connection. Communication with the creator was unsuccessful.

You don't have ADB with the original software?

That could suggest a different kind of problem.
 
The following users thanked this post: baciocco

Offline dzebrys

  • Contributor
  • Posts: 17
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4264 on: November 28, 2025, 05:59:50 pm »
gesture swipe on right screen side is not working
It was always swipe from the top corner to bottom. It's purely Android code.

nothing like this is working for me. the only corner swipe i spot some reaction is right bottom one.
the difference from no-reaction is i can see some blue'ish hue at bottom, approximately 1/5 of lenght,
aligned right.

BTW. In my mod there is a third party replacement for this, which You can enable manually. It's has a lot of settings and it seems to have less bugs with basic things. Screenshot in the attachment.

i've also tried to disabled it, not change.

If for some reason You still can't get into Nova launcher (Android desktop), connect USB keyboard, ALT+TAB and swipe out the scope app.

the only key combination which works in that "god mode" is Win+n what triggers notification bar from top.
other than that no any std key shortcut works.

the only way to get into launcher is to kill the scope app either via adb or Settings->Apps.


what is interesting, when finally in launcher or any other app than scope, the navbar is visible, however the only key which works is triangle (back), other 2 have no action - dead (circle, square). so after starting any app going back to launcher is again problematic.

when logcat enabled, whenever i press not working nav button i got this sinny set of traces related to audioDevice:
Code: [Select]
11-28 17:11:21.815   649   649 W TelecomManager: Telecom Service not found.
11-28 17:11:21.821   240   284 D AudioHardwareTiny: start_output_stream device: 2
11-28 17:11:21.821   240   284 D AudioHardwareTiny: card0 id:rockchipes8323
11-28 17:11:21.821   240   284 D AudioHardwareTiny: No exist proc/asound/card1/id, break and finish parsing
11-28 17:11:21.821   240   284 D AudioHardwareTiny: dump out device info
11-28 17:11:21.821   240   284 D AudioHardwareTiny: dev_info SPEAKER  card=0, device:0
11-28 17:11:21.821   240   284 D AudioHardwareTiny: dev_info HDMI  card=0, device:0
11-28 17:11:21.822   240   284 D AudioHardwareTiny: dev_info SPDIF  card=0, device:0
11-28 17:11:21.822   240   284 D AudioHardwareTiny: dev_info BT  card=0, device:0
11-28 17:11:21.822   240   284 D alsa_route: route_info->sound_card 0, route_info->devices 0
11-28 17:11:21.822   240   284 D alsa_route: route_set_controls() set route 0

11-28 17:11:21.978   552   605 I WindowManager: Not starting activity because user setup is in progress: Intent { act=android.intent.action.MAIN cat=[android.intent.category.HOME] flg=0x10200000 (has extras) }

11-28 17:11:24.925   240   284 D AudioHardwareTiny: do_out_standby,out = 0xea9da180,device = 0x2
11-28 17:11:24.926   240   284 D alsa_route: route_set_controls() set route 24
11-28 17:11:24.926   240   284 D AudioHardwareTiny: close device

11-28 17:11:51.948   240   284 D AudioHardwareTiny: start_output_stream device: 2
11-28 17:11:51.948   240   284 D AudioHardwareTiny: card0 id:rockchipes8323
11-28 17:11:51.948   240   284 D AudioHardwareTiny: No exist proc/asound/card1/id, break and finish parsing
11-28 17:11:51.948   240   284 D AudioHardwareTiny: dump out device info
11-28 17:11:51.948   240   284 D AudioHardwareTiny: dev_info SPEAKER  card=0, device:0
11-28 17:11:51.948   240   284 D AudioHardwareTiny: dev_info HDMI  card=0, device:0
11-28 17:11:51.948   240   284 D AudioHardwareTiny: dev_info SPDIF  card=0, device:0
11-28 17:11:51.948   240   284 D AudioHardwareTiny: dev_info BT  card=0, device:0
11-28 17:11:51.949   240   284 D alsa_route: route_info->sound_card 0, route_info->devices 0
11-28 17:11:51.949   240   284 D alsa_route: route_set_controls() set route 0

11-28 17:11:55.073   240   284 D AudioHardwareTiny: do_out_standby,out = 0xea9da180,device = 0x2
11-28 17:11:55.073   240   284 D alsa_route: route_set_controls() set route 24
11-28 17:11:55.073   240   284 D AudioHardwareTiny: close device

seems like most important for it is to play some sound on scope.

my userspace apps list:
Code: [Select]
AnySoftKeyboard
Calculator++
DuckDuckGo
Explorer
launcher
Lightning
NovaLauncher
RIGOL.SCOPE
Settings
webcontrol

Code: [Select]
rk3399_rigol:/ # ll /data/app
total 18
drwxrwx--x  9 system system 1024 2025-11-28 17:16 .
drwxrwx--x 43 system system 1024 2025-11-28 16:33 ..
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 com.duckduckgo.mobile.android-2
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 com.menny.android.anysoftkeyboard-2
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 com.rigol.launcher-2
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 com.rigol.scope-2
drwxr-xr-x  4 system system 1024 2013-01-18 08:51 com.rigol.webcontrol-1
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 com.teslacoilsw.launcher-2
drwxr-xr-x  4 system system 1024 2025-10-27 20:23 org.solovyev.android.calculator-2

Code: [Select]
rk3399_rigol:/ # ll /data/user/0/
total 178
drwxrwx--x 55 system    system    3072 2025-11-28 17:16 .
drwxrwx--x 43 system    system    1024 2025-11-28 16:33 ..
drwx------ 11 u0_a23    u0_a23    1024 2025-11-28 17:33 acr.browser.barebones
drwx------  4 system    system    1024 2013-01-18 08:50 android
drwx------  4 u0_a5     u0_a5     1024 2013-01-18 08:50 android.ext.services
drwx------  4 u0_a21    u0_a21    1024 2013-01-18 08:50 android.ext.shared
drwx------  5 system    system    1024 2025-09-30 20:06 android.rockchip.update.service
drwxr-x--x  4 u0_a28    u0_a28    1024 2025-09-30 19:06 com.ampak.rftesttool
drwx------  4 u0_a0     u0_a0     1024 2025-09-30 19:06 com.android.backupconfirm
drwx------  4 bluetooth bluetooth 1024 2025-11-28 17:33 com.android.bluetooth
drwx------  4 u0_a18    u0_a18    1024 2025-09-30 19:06 com.android.captiveportallogin
drwx------  4 u0_a19    u0_a19    1024 2025-09-30 19:06 com.android.certinstaller
drwx------  4 u0_a20    u0_a20    1024 2025-09-30 19:06 com.android.cts.ctsshim
drwx------  4 u0_a2     u0_a2     1024 2025-09-30 19:06 com.android.cts.priv.ctsshim
drwx------  4 u0_a3     u0_a3     1024 2013-01-18 08:50 com.android.defcontainer
drwx------  4 u0_a17    u0_a17    1024 2025-09-30 19:06 com.android.dreams.basic
drwx------  4 u0_a6     u0_a6     1024 2025-09-30 19:06 com.android.externalstorage
drwxr-x--x  4 u0_a22    u0_a22    1024 2025-09-30 19:06 com.android.htmlviewer
drwx------  4 system    system    1024 2013-01-18 08:50 com.android.inputdevices
drwx------  5 system    system    1024 2025-10-27 20:23 com.android.keychain
drwx------  4 system    system    1024 2013-01-18 08:50 com.android.location.fused
drwx------  5 u0_a7     u0_a7     1024 2025-09-30 20:06 com.android.managedprovisioning
drwx------  5 u0_a4     u0_a4     1024 2025-11-24 13:13 com.android.mtp
drwx------  4 u0_a8     u0_a8     1024 2013-01-18 08:50 com.android.packageinstaller
drwx------  4 u0_a24    u0_a24    1024 2025-09-30 19:06 com.android.pacprocessor
drwx------  4 u0_a26    u0_a26    1024 2025-09-30 19:06 com.android.printservice.recommendation
drwx------  6 u0_a27    u0_a27    1024 2025-09-30 19:06 com.android.printspooler
drwx------  4 u0_a1     u0_a1     1024 2013-01-18 08:50 com.android.providers.blockednumber
drwx------  5 u0_a4     u0_a4     1024 2025-09-30 20:06 com.android.providers.downloads
drwx------  6 u0_a4     u0_a4     1024 2025-09-30 20:06 com.android.providers.media
drwx------  4 system    system    1024 2013-01-18 08:50 com.android.providers.settings
drwx------  5 u0_a1     u0_a1     1024 2013-01-18 08:52 com.android.providers.userdictionary
drwx------  4 u0_a9     u0_a9     1024 2025-09-30 19:06 com.android.provision
drwx------  4 u0_a10    u0_a10    1024 2013-01-18 08:50 com.android.proxyhandler
drwx------  4 u0_a11    u0_a11    1024 2025-09-30 19:06 com.android.retaildemo
drwxr-x--x  4 system    system    1024 2025-09-30 19:06 com.android.rk
drwx------  4 system    system    1024 2013-01-18 08:50 com.android.settings
drwx------  4 u0_a12    u0_a12    1024 2025-09-30 19:06 com.android.sharedstoragebackup
drwx------  4 shell     shell     1024 2013-01-18 08:50 com.android.shell
drwx------  4 u0_a29    u0_a29    1024 2025-09-30 19:06 com.android.smspush
drwx------  4 u0_a13    u0_a13    1024 2025-09-30 19:06 com.android.statementservice
drwx------  4 u0_a14    u0_a14    1024 2025-09-30 19:06 com.android.storagemanager
drwx------  4 u0_a15    u0_a15    1024 2013-01-18 08:50 com.android.systemui
drwx------  4 system    system    1024 2025-09-30 19:06 com.android.wallpaperbackup
drwx------  4 u0_a16    u0_a16    1024 2025-09-30 19:06 com.android.wallpapercropper
drwxr-x--x  4 u0_a30    u0_a30    1024 2025-09-30 19:06 com.android.wallpaperpicker
drwx------  4 u0_a31    u0_a31    1024 2025-09-30 19:06 com.android.webview
drwx------ 10 u0_a32    u0_a32    1024 2025-11-28 16:48 com.duckduckgo.mobile.android
drwx------  7 u0_a37    u0_a37    1024 2025-10-28 14:04 com.menny.android.anysoftkeyboard
drwx------  6 system    system    1024 2025-09-30 20:06 com.rigol.launcher
drwx------  6 system    system    1024 2025-09-30 20:06 com.rigol.scope
drwx------  6 system    system    1024 2025-09-30 20:06 com.rigol.webcontrol
drwx------  4 u0_a25    u0_a25    1024 2025-09-30 19:06 com.svox.pico
drwx------  8 u0_a33    u0_a33    1024 2025-09-30 19:06 com.teslacoilsw.launcher
drwx------  6 u0_a36    u0_a36    1024 2013-01-18 08:59 org.solovyev.android.calculator

as one can see factory apps have system user/group, whether the 3pp sideloaded by mod script are userspace


br/Piotr
 

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4265 on: November 28, 2025, 06:59:05 pm »
In such case, instead of spending hours with figuring it out, I would chose to flash SD card back again.

Unless You don't want to remove warranty sticker, which I guess You don't have.

Offline westendgate

  • Newbie
  • Posts: 4
  • Country: de
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4266 on: November 29, 2025, 11:34:10 am »
gesture swipe on right screen side is not working
It was always swipe from the top corner to bottom. It's purely Android code.

nothing like this is working for me. the only corner swipe i spot some reaction is right bottom one.
the difference from no-reaction is i can see some blue'ish hue at bottom, approximately 1/5 of lenght,
aligned right.

BTW. In my mod there is a third party replacement for this, which You can enable manually. It's has a lot of settings and it seems to have less bugs with basic things. Screenshot in the attachment.

i've also tried to disabled it, not change.

If for some reason You still can't get into Nova launcher (Android desktop), connect USB keyboard, ALT+TAB and swipe out the scope app.

the only key combination which works in that "god mode" is Win+n what triggers notification bar from top.
other than that no any std key shortcut works.

the only way to get into launcher is to kill the scope app either via adb or Settings->Apps.


I had the same issue. Today I reflashed the card with Dave's image. Then I updated to the latest version. Afterwards, I installed the NK-Mod via the .gel file. One manual restart is necessary, then everything runs automatically. After entering the license and subsequent self-calibration, everything works as expected. The swipe in the top right corner works, and all three buttons function correctly. Good work, Norbert!
 
The following users thanked this post: norbert.kiszka

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4267 on: November 30, 2025, 01:35:42 am »
Little boring work with some good results. I found a lot of low pass filters.

Summary from my current notes:

Filters in AFE:

  • no signal (real AFE GND coupling)
  • Test sin 8 MHz: 831 mV -> 448 mV (-5.3 dB)
    Test sin 5 MHz: 842 mV -> 620.2 mV (-2.66 dB)
    5 MHz
  • Test sin 10 MHz: 826 mV -> 639.5 mV (-2.21 dB)
    Test sin 12 MHz: 798 mV -> 535 mV
    12 MHz
  • Test sin 16 MHz: 777 mV -> 568 mV
    Test sin 17 MHz: 780 mV -> 553 mV
    Test sin 20 MHz: 821 mV -> 523 mV
    ~16 MHz
  • 19.8 ns (18 MHz 23 MHz)
    Test sin 16 MHz: 777 mV -> 646 mV
    Test sin 18 MHz: 805.3 mV -> 635 mV
    Test sin 20 MHz: 821 mV -> 598 mV
    Test sin 21 MHz: 760 mV -> 603 mV
    Test sin 25 MHz: 941 mV -> 609 mV
    ~23 MHz
  • 15.8 ns (22 MHz 28.5 MHz)
    Test sin 18 MHz: 805.3 mV -> 695 mV
    Test sin 22 MHz: 762 mV -> 673 mV
    Test sin 30 MHz: 742 mV -> 520 mV
    30 MHz
    (used as a 20 MHz in stock app together with SPU filter enabled)
  • 11.3 ns (31 MHz 40 MHz)
    Test sin 40 MHz: 718 mV -> 516 mV
    40 MHz
  • 10 ns (35 MHz 45 MHz)
    Test sin 40 MHz: 718 mV -> 551 mV
    Test sin 45 MHz: 698.5 mV -> 506 mV
    45 MHz
  • 8.8 ns (40 MHz 51 MHz)
    Test sin 45 MHz: 698.5 mV -> 534 mV
    Test sin 50 MHz: 669 mV -> 489 mV
    50 MHz
  • 8 ns (44 MHz 56 MHz)
    Test sin 50 MHz: 669 mV -> 512 mV
    55 MHz

Filters in SPU:

  • off
  • used with "20 MHz" official filter -> enabled alone gives ~20 MHz cutoff.

For 99% there are more filters  :phew:

Adding this to UI will be much more time consuming. Right now it's hardcoded.
 
The following users thanked this post: thm_w, westendgate, baciocco

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4268 on: November 30, 2025, 06:00:02 am »
Accidentally I figured out all binary flags for AFE BW filters. At least I think so.

There are different sets of possible low pass filter(s) settings. Few thousand possible settings in total.

It's possible to calculate theoretical cutoff frequency from those flags. Lowest possible cutoff frequency is 5 MHz.

What was most interesting for me personally, was "OFF" setting. There is a "small" difference between firmware for DHO800/900 and firmware for MHO900/MHO98. Same AFE but different flags for the exact same setting.

"OFF" in MHO900 exactly as I expected is just a little bit above 1 GHz (max official bandwidth of this series is 1 GHz). When OFF and 50 ohm impedance is selected in MHO98, it send flags for 1350 MHz.

While "OFF" in DHO800/900 is... 3150 MHz. Of course this is a theoretical bandwidth, because the whole analog path is a low pass filter. Beside of the low sample rate (~2.1 GSa/s after overclocking) and LC filters on PCB, which BTW can be removed or replaced.

I think Rigol will "like" me much more than in the last few weeks.

Offline ptluis

  • Frequent Contributor
  • **
  • Posts: 713
  • Country: pt
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4269 on: December 01, 2025, 09:48:17 am »
...Rigol payed good enough money. I guess 100$ was enough...

It's unbelievable and very sad. At the very least, they should purchase our modifications to copy the fixes and improvements. I think that we contribute to their hardware sales.

Lies! Lies! Lies! Completely false! Neither Rigol nor any manufacturer pays to remove posts or ban users who engage in cracking/hacking activities. Administrators usually receive notifications about the laws they are violating and the consequences of continuing to allow such acts through the platform. They usually remove the offender to maintain the platform, which took a lot of work to create. Therefore, Norbert, it's not worth spreading lies just to play the victim. Keep cracking; the only one who might be harmed is the owner of this forum.

As for the software you're cracking, it's normal that it has many bugs because it's a beta version, dumped from the BETA unit sent to Dave, so it's an unfinished version. What you're selling is a beta version with improvements that no one has yet confirmed work well.

And to conclude, you must think that Rigol's engineers are all ignorant fools who don't know how to do their job, right? So, you believe in Santa Claus, do you?

 Norbert, since you're a guru of wisdom, why don't you make a Sparrow app from scratch? I'd love to see that.

Rigol, you should fire all the dumb engineers working for you and hire only Norbert; he's the real guru who would make your products unique, bug-free, with extra backdoors for worldwide access. Perfect work of art!
 

Offline NE666

  • Frequent Contributor
  • **
  • Posts: 617
  • Country: gb
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4270 on: December 01, 2025, 10:01:27 am »
Lies! Lies! Lies!

Kid, please go scream at your mommy.

As has been made clear to you previously, no one else is interested in your insults and tantrums, nor your constant attempts to derail technical threads.
 
The following users thanked this post: TUMEMBER, zelectronicauy

Offline TUMEMBER

  • Regular Contributor
  • *
  • Posts: 104
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4271 on: December 01, 2025, 10:27:51 am »
...Rigol payed good enough money. I guess 100$ was enough...

It's unbelievable and very sad. At the very least, they should purchase our modifications to copy the fixes and improvements. I think that we contribute to their hardware sales.

Lies! Lies! Lies! Completely false! Neither Rigol nor any manufacturer pays to remove posts or ban users who engage in cracking/hacking activities. Administrators usually receive notifications about the laws they are violating and the consequences of continuing to allow such acts through the platform. They usually remove the offender to maintain the platform, which took a lot of work to create. Therefore, Norbert, it's not worth spreading lies just to play the victim. Keep cracking; the only one who might be harmed is the owner of this forum.

As for the software you're cracking, it's normal that it has many bugs because it's a beta version, dumped from the BETA unit sent to Dave, so it's an unfinished version. What you're selling is a beta version with improvements that no one has yet confirmed work well.

And to conclude, you must think that Rigol's engineers are all ignorant fools who don't know how to do their job, right? So, you believe in Santa Claus, do you?

 Norbert, since you're a guru of wisdom, why don't you make a Sparrow app from scratch? I'd love to see that.

Rigol, you should fire all the dumb engineers working for you and hire only Norbert; he's the real guru who would make your products unique, bug-free, with extra backdoors for worldwide access. Perfect work of art!
:-- :rant:
Reported for ban for constantly cluttering threads. Take a break from the forum.
W życiu nie ma nic za darmo, są tylko różne formy płatności.
Wciąż płacimy okruchami własnego czasu.
 

Offline ptluis

  • Frequent Contributor
  • **
  • Posts: 713
  • Country: pt
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4272 on: December 01, 2025, 11:12:11 am »
...Rigol payed good enough money. I guess 100$ was enough...

It's unbelievable and very sad. At the very least, they should purchase our modifications to copy the fixes and improvements. I think that we contribute to their hardware sales.

Lies! Lies! Lies! Completely false! Neither Rigol nor any manufacturer pays to remove posts or ban users who engage in cracking/hacking activities. Administrators usually receive notifications about the laws they are violating and the consequences of continuing to allow such acts through the platform. They usually remove the offender to maintain the platform, which took a lot of work to create. Therefore, Norbert, it's not worth spreading lies just to play the victim. Keep cracking; the only one who might be harmed is the owner of this forum.

As for the software you're cracking, it's normal that it has many bugs because it's a beta version, dumped from the BETA unit sent to Dave, so it's an unfinished version. What you're selling is a beta version with improvements that no one has yet confirmed work well.

And to conclude, you must think that Rigol's engineers are all ignorant fools who don't know how to do their job, right? So, you believe in Santa Claus, do you?

 Norbert, since you're a guru of wisdom, why don't you make a Sparrow app from scratch? I'd love to see that.

Rigol, you should fire all the dumb engineers working for you and hire only Norbert; he's the real guru who would make your products unique, bug-free, with extra backdoors for worldwide access. Perfect work of art!
:-- :rant:
Reported for ban for constantly cluttering threads. Take a break from the forum.

Not constantly, just those with explicitly ilegal content or lies on it.
But be my guest snitch it
 

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4273 on: December 01, 2025, 03:22:41 pm »
Reported for ban for constantly cluttering threads. Take a break from the forum.

Moderation on this forum is practically non existent and likely biased by number of reports, without reading anything. Instead we have internet trolls funded by Rigol.

It's better to ignore them. It's a waste of time - they make very good advertisement for this projects. Perfect example of Streisand effect.

Speaking of the project, right now Im working on the new UI bandwidth selection. Exactly 48 options of a bandwidth filtering in AFE. I think it should be ready in 1-2 days max.
 
The following users thanked this post: thm_w, TUMEMBER, baciocco

Offline norbert.kiszka

  • Super Contributor
  • ***
  • Posts: 1032
  • Country: pl
Re: Hacking the Rigol DHO800/900 Scope
« Reply #4274 on: December 02, 2025, 02:44:03 am »
Coming back to insane amount of possible low pass settings in AFE, I did two tests with same exact square wave generator with fast rise time and with overclocked PLL (2 GSa/a).

At first I measured rise time on unmodified CH2 with 50 ohm terminator and with BNC T-connector. Rise time was 1.475 ns (2.36 divided by 1.6, because the app doesn't "know" real sample rate).

After that I switched this generator to CH4 which has bypassed LC filters, changed termination resistors (between AFE and ADC) and added 50 ohm termination directly to the BNC joints on PCB.

On this CH4 I selected filter in AFE with rise time 1.5 ns, which is close enough.

After this and few other experiments, it looks like AFE filter(s) is doing much better job than original LC filters on scope PCB.

Screenshot is in the attachment below. Red line is a reference saved from mentioned CH2. Interpolation is sinc in both cases.

PS. AFE filter flags was hardcoded, so please ignore the bottom bar.
 
The following users thanked this post: thm_w, baciocco


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf